@abstraxn/signer-react (>=2.0.2, <=3.3.3), @account-kit/react (>=4.53.1-alpha.0, <=4.88.5) +690 more potentially affected by CVE-2026-59877 via protobufjs (>=7.5.0, <=7.6.4)

protobufjs NPM version =7.5.0, =2.0.2, =4.53.1-alpha.0, =4.15.0, =3.26.0, =0.1.0, =1.9.1, =2.1.7-alpha-2, =0.1.0, =1.0.0-canary.15, =0.0.2, =0.0.1, =0.0.0-experimental-02e44603-20260603, =0.0.0-experimental-02e44603-20260603, =1.1.0 and more Source cves: CVE-2026-59877 Source advisory:...

@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +322 more potentially affected by CVE-2026-14631 via webpack-dev-server (>=5.0.0, <=5.2.5)

webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =8.0.0-next.2, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =0.7.7, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2 and more Source cves: CVE-2026-14631 Source advisory: OSV:GHSA-M28W-2PQF-7Q...

@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +322 more potentially affected by CVE-2026-14620 via webpack-dev-server (>=5.0.0, <=5.2.5)

webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =8.0.0-next.2, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =0.7.7, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2 and more Source cves: CVE-2026-14620 Source advisory: OSV:GHSA-F5VJ-F2HX-8M...

@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +910 more potentially affected by CVE-2026-59871 via tar (>=7.0.0, <=7.5.17)

tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-59871 Source advisory: OSV:GHSA-W8WR-V893-VJVP...

@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +915 more potentially affected by CVE-2026-59873 via tar (>=7.0.0, <=7.5.18)

tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-59873 Source advisory: OSV:GHSA-23HP-3JRH-7FPW...

@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +910 more potentially affected by CVE-2026-59874 via tar (>=7.0.0, <=7.5.17)

tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-59874 Source advisory: OSV:GHSA-8X88-C5MF-7J5W...

@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +907 more potentially affected by CVE-2026-59875 via tar (>=7.0.0, <=7.5.16)

tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-59875 Source advisory: OSV:GHSA-GVWX-54WH-QM9J...

0.edsql (>=1.0.49, <=1.0.50), 10secondsofcode-custom (1.0.0) +2058 more potentially affected by CVE-2026-59725 via engine.io (>=4.1.1, <=6.6.6)

engine.io NPM version =4.1.1, =1.0.49, =1.0.0, =0.0.28, =1.0.1, =0.8.2, =1.0.0, =0.1.13, =0.0.4, =1.2.1, =15.0.0, =1.0.1, =1.0.2 - @aaronconway7/create-gatsby-app 1.0.0 - @accio-cms/gatsby-starter-accio 0.0.1 and more Source cves: CVE-2026-59725 Source advisory: OSV:GHSA-R635-G3XR-VW7X...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0726react (0.1.1) +28170 more potentially affected by CVE-2026-13311 via shell-quote (>=1.3.3, <=1.8.4)

shell-quote NPM version =1.3.3, =1.0.1, =1.1.0 - 0726react 0.1.1 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 - 0xgank-tea-characteristic 1.0.0 -...

@adobe/helix-docx2md (1.9.29), @adobe/helix-importer (>=3.4.141, <=3.4.143) +33 more potentially affected by CVE-2026-59868 via js-yaml (>=5.0.0, <=5.1.0)

js-yaml NPM version =5.0.0, =3.4.141, =2.2.62, =1.0.8, =0.2.12, =0.2.12, =0.2.12, =0.2.13, =0.2.12, =0.2.16, =0.2.14, =0.2.12, =0.2.17 and more Source cves: CVE-2026-59868 Source advisory: OSV:GHSA-G796-FGMG-93MV...

02-infrastructure (1.0.0), 02vue_toast_demo (>=1.0.0, <=1.0.4) +21408 more potentially affected by CVE-2026-59869 via js-yaml (>=3.0.0, <=3.14.2)

js-yaml NPM version =3.0.0, =1.0.0, =1.0.4, =5.0.0, =1.0.3, =2.0.0, =0.0.1, =0.0.2 - 23g-base-css 1.0.0 and more Source cves: CVE-2026-59869 Source advisory: OSV:GHSA-52CP-R559-CP3M...

02.aula (1.0.0), 0xrtest (1.0.0) +10558 more potentially affected by CVE-2026-59869 via js-yaml (>=4.0.0, <=4.2.0)

js-yaml NPM version =4.0.0, =0.2.0, =0.0.3, =4.11.0, =0.0.1, =1.1.9, =0.1.23, =0.1.4, =6.1.5, =0.2.0, =0.14.0 and more Source cves: CVE-2026-59869 Source advisory: OSV:GHSA-52CP-R559-CP3M...

@adobe/aem-cli (>=16.21.1, <=16.21.2), @adobe/helix-docx2md (>=1.9.29, <=1.9.30) +48 more potentially affected by CVE-2026-59870 via js-yaml (>=5.0.0, <=5.2.0)

js-yaml NPM version =5.0.0, =16.21.1, =1.9.29, =3.4.141, =7.1.20, =2.2.62, =1.5.3, =1.0.8, =0.0.0-next-20260630092247, =0.0.0-next-20260630092247, =0.0.0-next-20260630092247, =0.0.0-next-20260824173136 and more Source cves: CVE-2026-59870 Source advisory: OSV:GHSA-724G-MXRG-4QVM...

astro-simpleanalytics-plugin (0.4.0), create-sorapaper-astro-theme (1.0.0) +2 more potentially affected by unknown CVE via astro (>=7.0.2, <=7.0.6)

astro NPM version =7.0.2, =0.1.0, =1.0.0, =1.0.1 Source cves: unknown CVE Source advisory: SNYK:JS-ASTRO-18085586...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @a1st/aix (>=0.0.3, <=0.6.0) +749 more potentially affected by CVE-2026-73422 via astro (>=2.9.0, <=7.0.6)

astro NPM version =2.9.0, =0.0.1, =0.0.3, =0.2.0, =1.1.0, =1.0.0, =1.3.0, =0.9.0, =0.1.6, =1.0.0, =0.5.0, =1.0.0, =1.0.0, =1.0.7 - @arya-technologies/astro-template 0.0.1 and more Source cves: CVE-2026-73422 Source advisory: OSV:GHSA-4G3V-8H47-V7G6...

@inkeep/agents-api (>=0.0.0-dev-20260121145510, <=0.80.6), @inkeep/agents-cli (>=0.0.0-chat-to-edit-20251119071712, <=0.80.6) +17 more potentially affected by CVE-2026-53515 via @better-auth/sso (>=1.3.28, <=1.6.9)

@better-auth/sso NPM version =1.3.28, =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260106221934, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260203033642...

03-gs-ee-6 (0.3.5), @albgen/capacitor-escpos-plugin (>=0.0.4, <=1.0.1) +2934 more potentially affected by CVE-2026-13149 via brace-expansion (>=3.0.0, <=5.0.6)

brace-expansion NPM version =3.0.0, =0.0.4, =1.1.7, =1.1.8 - @angranit/fantom-virma 0.1.0 - @angranit/first-step-to-get-tea 0.1.0 - @angranit/hapeipons 1.1.2 - @angranit/nearly-vm 0.1.0 - @angranit/newme-project 0.1.0 - @angranit/npmjs-for-tea-project 0.1.0 - @angranit/phantompirs 0.1.0 -...

@activepieces/piece-google-gemini (0.1.6), @activepieces/piece-google-vertexai (0.1.2) +8 more potentially affected by CVE-2026-13149 via brace-expansion (>=2.0.0, <=2.0.2)

brace-expansion NPM version =2.0.0, =0.2.1, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-13149 Source advisory: OSV:GHSA-3JXR-9VMJ-R5CP...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +28 more potentially affected by CVE-2026-13149 via brace-expansion (>=1.1.0, <=1.1.13)

brace-expansion NPM version =1.1.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.9.6-canary.2, =0.0.3, =0.1.0 and more Source cves: CVE-2026-13149 Source advisory: OSV:GHSA-3JXR-9VMJ-R5CP...

Malicious code in upjsma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6da6be7241858aacc6bf0fdef363fad9469efcbd9414b7b6e3e4153eba341f7b The package's main entry is a browser-only IIFE that, when bundled into a web page, overlays a full-screen mask, injects a fullscreen iframe, and...